Hello,
First thing:
I've been using nessus 1.0 for a while and wanted to give version 1.1.13 a
try. Everything is fine except for one thing:
- The find_services.nes plugin timeouts on almost every host I tried it on
(even when raising the timeout for this plugin to 10 minutes). Is this a
known bug? It seems to happen when one of the open ports accept any input
but never send any output (ie: discard-like service). I haven't seen
anything about this in the archives. (NB: it happens when scanning on the
local network, so it's not a firewall or traffic issue).
Any hint ? (several other plugins also always timeout like
port_shell_execution.nasl for example)
Second thing:
- Since I don't like to complain without contributing, I attached a patch
to find_service.c that allows it to detect 3 more services: cvs-pserver,
mysql and postgresql. One warning through: the MySQL detection is
incomplete: it only detects when the host based identification fails.
Cordialement,
--
Vincent RENARDIAS
Directeur Technique
StrongHoldNET / http://www.strongholdnet.com
--- /tmp/find_service.c Tue Mar 19 17:34:16 2002
+++ new.c Wed Mar 20 13:53:24 2002
@@ -345,10 +346,43 @@
void
+mark_postgresql(desc, port, buffer)
+ struct arglist * desc;
+ int port;
+ char * buffer;
+{
+ plug_set_key(desc, "Services/postgresql", ARG_INT, (void *)port);
+ if (port != 5432) post_note(desc, port, "a PostgreSQL server is running on this
+port");
+}
+
+void
+mark_mysql(desc, port, buffer)
+ struct arglist * desc;
+ int port;
+ char * buffer;
+{
+ plug_set_key(desc, "Services/mysql", ARG_INT, (void *)port);
+ if (port != 3306) post_note(desc, port, "a MySQL server is running on this port");
+}
+
+
+void
+mark_cvspserver(desc, port, buffer)
+ struct arglist * desc;
+ int port;
+ char * buffer;
+{
+ plug_set_key(desc, "Services/cvspserver", ARG_INT, (void *)port);
+ if (port != 2401) post_info(desc, port, "a CVS pserver server is running on
+this port");
+}
+
+
+
+void
mark_wild_shell(desc, port, buffer)
struct arglist * desc;
int port;
@@ -701,17 +734,24 @@
* Many services run on the top of an HTTP protocol,
* so the HTTP test is not an 'ELSE ... IF'
*/
+ /* put at the end -- V
if(!strncmp(line, "http/1.", 7))
{
flg++;
mark_http_server(desc, port, banner, trp);
}
-
+ */
if(((u_char)buffer[0]==255) && (((u_char)buffer[1]==251) ||
((u_char)buffer[1]==252) || ((u_char)buffer[1]==253) || ((u_char)buffer[1]==254)))
mark_telnet_server(desc, port, origline, trp);
else if((strstr(line, "smtp") || strstr(line, "simple mail transfer")) &&
!strncmp(line, "220", 3))
mark_smtp_server(desc, port, origline, trp);
+ else if((!strncmp(line, "HHost '", 7) || (!strncmp(line, "WHost '", 7)) &&
+strstr(line, "MySQL"))
+ mark_mysql(desc, port, origline, trp);
+ else if(!strncmp(line, "EFATAL ", 7))
+ mark_postgresql(desc, port, origline, trp);
+ else if(!strncmp(line, "cvs [pserver aborted]:", 22))
+ mark_cvspserver(desc, port, origline, trp);
else if(strstr(buffer, "rmserver")||strstr(buffer, "realserver"))
mark_rmserver(desc, port, origline, trp);
else if(strstr(line, "ftp") && !strncmp(line, "220", 3))
@@ -754,8 +794,13 @@
mark_echo_server(desc, port ,origline);
else if(strstr(banner, "!\"#$%&'()*+,-./") && strstr(banner, "ABCDEFGHIJ") &&
strstr(banner, "abcdefghij") && strstr(banner, "0123456789"))
mark_chargen_server(desc, port, banner);
- else
- unindentified_service = ! flg;
+ else if(!strncmp(line, "http/1.", 7))
+ {
+ flg++;
+ mark_http_server(desc, port, banner, trp);
+ }
+ else
+ unindentified_service = ! flg;
efree(&line);
efree(&origline);
}
